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A flight control system architecture for the NASA AirSTAR infrastructure has been 
designed to address the challenges associated with safe and efficient flight testing of research 
control laws in adverse flight conditions. The AirSTAR flight control system provides a 
flexible framework that enables NASA Aviation Safety Program research objectives, and 
includes the ability to rapidly integrate and test research control laws, emulate component 
or sensor failures, inject automated control surface perturbations, and provide a baseline 
control law for comparison to research control laws and to increase operational efficiency. 
The current baseline control law uses an angle of attack command augmentation system for 
the pitch axis and simple stability augmentation for the roll and yaw axes. 
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I. Introduction 

T HE Integrated Resilient Aircraft Controls (IRAC) project and the Integrated Vehicle Health Management 
(IVHM) project, both part of the NASA Aviation Safety Program, are focused on flight research of transport- 
category aircraft during adverse flight conditions such as upsets, damage, and failures. One of the key research areas 
is developing adaptive control algorithms and strategies for transport-category aircraft during adverse conditions. An 
important part of this research is flight validation of controller performance and stability in realistic scenarios. Full 
6-DOF simulation can play an important role in the validation process 1 , but flight testing is ultimately required due 
to the complex and relatively unexplored nature of transport aircraft dynamics in the flight regimes of interest. 
However, flight testing a full scale manned transport aircraft in adverse flight conditions has unacceptable safety 
risks and would be prohibitively expensive. To address these challenges, NASA has developed the Airborne 
Subscale Transport Aircraft Research (AirSTAR) flight test facility 2,3,4 . 

II. AirSTAR Overview 

AirSTAR is an integrated flight test infrastructure which utilizes remotely piloted, powered subscale models for 
flight testing. One particular use of AirSTAR is flight testing research control laws in adverse flight conditions. 
AirSTAR consists of a remotely piloted subscale test article, the Mobile Operations Station (MOS) (an integrated 
ground station and control room), and a test range. Under the current AirSTAR Concept of Operations (CONOPS) 
(Figure 1) a safety pilot, using a 
hobbyist radio control 
transmitter, performs the takeoff 
and climbs to a specified 
altitude, where control of the 
aircraft is transferred to a 
research pilot through a handoff 
maneuver. The research pilot 
executes the flight test plan from 
a research cockpit located in the 
MOS, which utilizes synthetic 
vision displays driven with 
aircraft sensor data. The research 
pilot uses a ground-based flight 
control system (FCS) that is 
connected to the aircraft through 
an L-band telemetry uplink and 
S-band telemetry downlink. 

Once the flight test maneuvers 
are complete, the safety pilot 
resumes control of the aircraft 
and performs the landing. The 
safety pilot is the pilot-in- 
command of the aircraft and determines who is in control of the aircraft (physically and procedurally) at all times via 
a switch on the safety pilot’s transmitter. When the onboard flight control unit (FCU) receives the appropriate 
command from the safety pilot, the FCU begins responding to the research pilot’s commands received through the 
L-band telemetry uplink. The command state of the FCU (i.e. who actually has control of the aircraft) is part of the 
data on the S-band telemetry downlink. 

A. Test Aircraft 

Currently, AirSTAR operates two fully instrumented test aircraft. The primary test aircraft is a 5.5% dynamically 
scaled (i.e. Froude-scaled) twin-turbine powered generic transport model (GTM). Dynamic scaling allows subscale 
flight test results to be applied to full-scale aircraft. This model (tail number T2) has a 6.5 ft wingspan, weighs 54 
lbs at takeoff, and has a flight time of approximately 10 minutes. The secondary test aircraft is a 48 lb single or twin- 
turbine powered commercial off-the-shelf (COTS) airframe kit modeled after the Lockheed L- 1011 TriStar aircraft. 
This model (tail number S2) is neither geometrically nor dynamically scaled to the full scale aircraft and functions 
as a surrogate model for the GTM aircraft for system checkout and flight test technique development. Both aircraft 
have identical engines, components, systems, and instrumentation to facilitate transfer of lessons learned during 



Figure 1. AirSTAR Concept of Operations. 
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developmental flights with the surrogate model. Each aircraft is outfitted with full flight test instrumentation, 
including angle of attack and angle of sideslip vanes, static and dynamic pressure, control surface positions, rate 
gyros and accelerometers, a 6-DOF 1NS/GPS package, and engine instrumentation. Downlink data update rates vary 
from 5 Hz on the GPS data to 200 Hz on the analog sensors. Uplink commands are received at 200 Hz. 


B. Software 

Software for AirSTAR is developed in The MathWorks MATLAB®/Simulink 8 environment and implemented 
on a ground-based dSPACE real-time computer located in the MOS. A block diagram of the ground-based software 

is shown in Figure 2. The commands from 
both pilots are input to the FCS, in 
addition to the aircraft sensor data, the 
output from the Calculated Parameters 
subsystem, and the Caution & Warning 
subsystem. The Calculated Parameters 
subsystem calculates unmeasured 
quantities such as airspeed and altitude 
(from dynamic and static pressure) and 
applies center of gravity offset corrections 
to appropriate sensor data. The Caution & 
Warning subsystem provides alerts and 
advisories to the pilot based on sensor 
data, as well as monitoring the status of 
the telemetry link and providing positive 
Figure 2. Block diagram of ground-based flight software. indication of telemetry dropouts or failure 

(defined as no data for 0.75 sec). The FCS outputs control surface and throttle commands in engineering units, 
which are calibrated to actuator commands and sent to the aircraft via the L-band telemetry uplink. 

Simulation is used extensively in the AirSTAR software development process. Desktop simulation is used for 
designing and initial checkout of control laws. Hardware-in-the-loop simulation using the MOS systems and the 
dSPACE computer is used for testing, checkout, flight profile planning, and mission rehearsals. 



Network communication 
blocks 


III. AirSTAR Flight Control System 

The vehicles and operational concept used by AirSTAR present some unique challenges: First and foremost, 
dynamically scaling an aircraft results in increased model airspeed, angular rates, wind loading, and increased pilot 
workload relative to a model that is only geometrically scaled. These factors make a dynamically scaled model more 
challenging to fly and less forgiving of mistakes. Second, under the current AirSTAR CONOPS, the aircraft must 
remain within visual range of the safety pilot, effectively limiting the test volume to an approximately 14-mile radius 
circle around the safety pilot, extending to -2000 feet above the surface in altitude. Limited test volume combined 
with the relatively high airspeeds of the test aircraft adds to the pilot’s workload. Third, the primary purpose of 
AirSTAR is to perform flight research and flight validation of multiple research control laws in adverse flight 
conditions, which presents unique challenges to flight testing in an efficient and safe manner. 

The AirSTAR FCS uses a reversionary build-up approach to mitigate the risks associated with flight testing 
complex research control laws. Complexity is added in distinct stages that can be quickly transitioned using a two- 
switch “arm” and “engage” process. The FCS is separated into three flight control law (FCL) modes, shown in 
Figure 3. These three modes are mutually exclusive; only one can be active at a time. Mode 1 is a stick-to-surface 
control law composed of stick shaping only; no sensor feedback is used. This mode is the reversionary control law 
and is simple by design. Mode 2 is the baseline FCL, containing a conventional (non-adaptive) closed-loop 
controller. Mode 3 is reserved for the research control laws, and can contain any number of FCLs, although only one 
can be operational at any given time. 

The FCS also contains three auxiliary modules that can be used in conjunction with Modes 1, 2, or 3: an 
Autothrottle, a Wavetrain module, and a Model Tracking & Failures module. The final component in the FCS is a 
Load Protection System (LPS), which is aimed at preventing the FCS from exceeding the structural limits of the test 
aircraft. The LPS, Transfer Logic, and Input Selection blocks are always active. 

Transfers between FCL modes and activation of other functions are controlled by the Transfer Logic block. The 
Input Selection block smoothes transitions between FCS modes by using linear faders. When a particular mode is 
engaged, its commands are faded in and the current commands are faded out at the same rate. All of the FCS 
components will be described in detail in the following sections. 
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A. Mode 1 FCL: Stick-to-Surface 

The Mode 1 FCL is a simple stick-to-surface control law that functions as the lowest reversionary mode of the 
AirSTAR FCS. This FCL applies exponential shaping to the research pilot’s side-stick (pitch and roll) inputs. Linear 
shaping is applied to the rudder pedal commands. The research pilot commands pitch and roll trim rate via a four- 
position “hat” switch located on the side-stick. A time-modulated gain is applied to the trim rates (i.e. trim rate 
increases when the hat switch is held in one position) which are integrated to form a control surface command. 
Rudder trim commands are input directly using an analog knob. 

When the safety pilot transfers control to the research pilot, the FCS is in Mode 1 by default. The AirSTAR FCS 
prevents control surface transients during the handoff by initializing the Mode 1 pitch and roll trim states to the 
safety pilot’s trim commands, which are received via a separate 72 MHz receiver located on the MOS. The safety 
pilot’s rudder trim command simply biases the research pilot’s rudder trim command. The safety pilot’s trim 
commands are not explicitly separated from the total surface command and are estimated by applying low-pass 
filters (time constant = 0.08 sec) to the elevator, aileron and rudder commands. Transients are also minimized 
procedurally by executing the handoff maneuver in a trimmed, sticks neutral flight condition. Once the control 
handoff to the research pilot has been performed, the safety pilot’s estimated trim commands are held until the safety 
pilot retakes control. 

C. Mode 2 FCL: Baseline Flight Control Law 

The Mode 2 Baseline FCL is a conventional closed-loop control law intended to improve test efficiency (relative 
to open-loop control), reduce research pilot workload, and provide a baseline for comparison of research control law 
performance. The initial design of this FCL utilizes an angle of attack Command Augmentation System (CAS) in 
the pitch axis and simple rate-feedback stability augmentation in the roll and yaw axes. Augmentation-type research 
control laws may use the Mode 2 FCL by copying this block into the Mode 3 subsystem. Angle of attack command 
was chosen for ease of use, simplicity, and suitability for capturing angle of attack set points for modeling 
experiments. Stability augmentation was chosen for the roll and yaw axes primarily for simplicity. 

The angle of attack CAS currently implemented in Mode 2 is a proportional-integral controller designed using 
the LQR design technique with a linear aerodynamic model derived from flight test data collected at 80 knots 
equivalent airspeed. Feedbacks are fdtered angle of attack and fdtered pitch rate, the latter of which is also washed 
out to remove steady-state pitch rate during turning flight. 

The research pilot commands angle of attack using the sidestick inceptor. Trim functionality is similar to Mode 
1, except the pitch trim controls trim angle of attack instead of the elevator. When Mode 2 is engaged, the initial 
trim angle of attack is set to the current angle of attack to mitigate transients. In addition, the integrator state is 
initialized so the initial Mode 2 outputs will match the current elevator command. If Mode 2 is engaged while the 
aircraft is in a trimmed, stick-neutral condition, there will be zero elevator transients. Integrator wind-up is 
prevented by halting integration and holding the integrator output value when the total elevator command is at the 
actuator limits and the integrator input would otherwise increase the wind-up. In addition, if telemetry dropouts are 
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Figure 4. Mode 2 angle of attack CAS structure. 


detected by the Caution & Warning system, integration is halted and the integrator output is held until telemetry link 
is restored. 

The angle of attack command is limited to prevent stall and excessive normal load factor. Using a simple linear 
aerodynamic body Z-axis force model, a maximum and minimum angle of attack can be computed given load factor 
limits, estimated weight, and current dynamic pressure (Eqs. 1-4). 
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The Mode 2 FCL also has simple rate-feedback Stability Augmentation Systems (SAS) in the roll and yaw axes. 
Both the roll and yaw SAS use filtered, washed out angular rates. Gains are scheduled with airspeed and are zeroed 
out above 120 knots equivalent airspeed. 

D. Mode 3 FCL: Research Flight Control Laws 

The Mode 3 FCL subsystem utilizes a selectable, enabled subsystem architecture that allows a large number of 
research control laws to be implemented concurrently and tested individually during a single flight. Research FCLs 
are disabled (i.e. the code is not executed) until the particular FCL is selected and armed. The selected research FCL 
outputs are not active until Mode 3 is engaged by the research pilot. Sensor failures can be emulated in the Mode 3 
FCL by modifying any or all of the sensor data from the aircraft. Any modification to the sensor data is local to the 
Mode 3 FCL and does not affect the remainder of the FCS. Finally, 30 channels of user-definable data can be sent 
out over the MOS network via UDP and observed in real-time during flight operations. Each FCL implemented in 
Mode 3 can define different parameters for the 30 user data channels, but only the armed/engaged FCL user data is 
sent out over the MOS network. 

E. Wavetrain 

The Wavetrain module provides the capability to inject arbitrary automated control surface perturbation 
commands. The perturbation commands are added to the active commands (Figure 3), downstream of the FCLs, but 
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upstream of the LPS and Model Tracking & Failures modules. A large number of user-defined perturbation profiles 
can be implemented, which are then selected during flight operations. 

F. Model Tracking & Failures 

The Model Tracking & Failures module, positioned downstream of the Wavetrain input (Figure 3), provides the 
capability to emulate control surface faults and failures during flight by modifying any of the control surface 
commands. A large number of user-defined failure profiles can be implemented, which are then selected during 
flight operations The present design is focused on simple failures, e.g. a stuck surface, bias, reduced effectiveness, or 
any combination of the three, which can be to be applied to any command (Eq. 5). The failures are applied relative 
to what the control surface commands are when this module is activated (So) to minimize transients. 

8 out = 8 0+ Gain * ( 5 in - 8 0 ) + BiaS ( 5 ) 


Planned development of this module includes a model tracking controller which will enable in-flight simulation 
of a range of dynamics, such as the aerodynamic effects of structural damage or icing. 

G. Autothrottle 

The airspeed-command autothrottle in the AirSTAR FCS can be used in conjunction with Mode 1, 2, or 3 and 
with the Wavetrain and Model Tracking & Failures modules. The autothrottle is intended to reduce research pilot 
workload (primarily during turns) by managing throttle commands. The autothrottle is a classically-designed 
proportional-integral controller which uses calibrated airspeed and washed-out airspeed for feedback data. Integrator 
wind-up protection is similar to what is used in the Mode 2 FCL; integration is halted and the integrator output is 
held when the command is at the actuator limits or a telemetry dropout is detected. 


H. Load Protection System 

The Load Protection System (LPS) is designed to prevent the FCS from exceeding the structural limits of the test 
aircraft. The primary focus of the LPS is normal load factor (-Nz), with secondary focus on side force loads (Ny). 
The LPS uses a two-step approach to prevent the FCS from exceeding normal load factor limits: the first approach 
(Plan A) is proactive and limits elevator authority as a function of dynamic pressure. Limiting elevator authority 
proactively was found to the most effective way to prevent excessive load factor. Simulation runs showed elevator 
hardovers resulted in very high g-onset rates which are difficult to reverse quickly enough to prevent excessive load 
factors. The second approach (Plan B) is reactive and sets the controls to a neutral position if the specified load 
factor thresholds are exceeded. This approach is intended as a backup in case Plan A fails to limit load factor as 
expected. 

The LPS Plan A elevator limits were set by first creating a database of peak load factor as function of dynamic 
pressure and elevator inputs by simulating elevator hardovers (step inputs and doublet inputs) from a range of 
trimmed flight conditions and recording the 
peak transient load factor. Given a 
maximum and minimum load factor limit, 
this database can be used to set the 
maximum allowable elevator authority as a 
function of dynamic pressure. 

Figure 5 is a plot of peak transient load 
factor versus equivalent airspeed for 
elevator hardover inputs (both steps and 
doublets). The solid blue line is the peak 
load factor without the LPS activated; 
these data are used to set the Plan A 
elevator limits. The dashed green lines 
show the peak load factors with the LPS 
(Plan A & B) engaged are below the yield 
limit (5.0g) and ultimate limit (6.4g) of the 
S2 aircraft (shown as dotted red lines). 

Excessive side force loads are 
prevented by limiting the rudder authority 



Figure 5. Simulated peak load factor for the S2 aircraft. 
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as a function of dynamic pressure. The 
rudder limits are set so a full rudder 
reversal at maximum attainable sideslip 
angle will not exceed the structural limits 
of the vertical tail at a given dynamic 
pressure. If the structural limits of the 
vertical tail are not known (as is the case 
for the S2 aircraft), the rudder limits are set 
to the maximum deflections expected to be 
needed for the maneuvers in the flight test 
plan. Figure 6 shows the elevator and 
rudder limits set by the LPS for the S2 
aircraft (plotted versus equivalent airspeed 
for clarity). 

If the structural limits of the aircraft are 
known, the LPS effectively mitigates the 
Figure 6. LPS elevator and rudder limits for the S2 aircraft. risk of structural damage due to excessive 
control inputs. As a result, research control laws can run through development and test iterations in a timely fashion 
with minimal risk to the test aircraft. 

I. Mode Transfer Logic 

The engagement of selectable FCL modes (Mode 1, 2, and 3) and modules (Wavetrain, Model Tracking & 
Failures, and Autothrottle) within the FCS is controlled by the Mode Transfer Logic block, which is designed to 
prevent inadvertent activation of FCS functions. All of the selectable FCS functions (except the Autothrottle) require 
the use of an “arm” switch and an “engage” switch to be active. The FCS functions must be armed prior to being 
engaged. The Autothrottle can be engaged whenever the research pilot has control. In addition, the following rules 
govern the FCS function: 

1. The FCS is locked in Mode 1 while the safety pilot is flying OR the telemetry link is inoperative. 

2. The FCS will automatically revert to Mode 1 if the safety pilot takes control or the telemetry link fails. All 
selectable functions are disabled and disarmed, and must be rearmed and reengaged when the research pilot 
has control again. 

3. The research pilot can manually revert the FCS to Mode 1 by pulling the trigger on the sidestick. This will 
only disengage, not disarm, any active functions. 

4. Any selectable function (except the Autothrottle) must be armed prior to being engaged. Disarming while 
engaged will turn off the function. 

5. Mode 2 and Mode 3 FCLs can not be engaged if the current command from these modes is at or beyond the 
LPS limits. 


J. Research Cockpit 

The primary inceptors for the 
research pilot are a sidestick, foot pedals, 
and throttle handles. Secondary inceptors 
include a flap handle, speed brake 
handle, and a gear switch. The primary 
interface to the FCS is through a number 
of hardware switches and knobs in the 
research cockpit. Due to the time- 
compressed nature of flight-testing 
dynamically-scaled vehicles, the Hands- 
On-Throttle-And-Stick (HOTAS) 

approach was used to design the research 
pilot interface to the FCS. The Flight 
Test Engineer (FTE) assists the research 
pilot during flight and is responsible for 
arming FCS functions, selecting profiles 



Figure 7. Primary Flight Display with FIUD. 
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for the Wavetrain and Model Tracking & 
Failures modules, and setting the 
Autothrottle. The research pilot is 
responsible for engaging and disengaging 
FCS functions and handling aircraft 
configuration changes. 

The research pilot and FTE use a 
number of displays during flight 
operations. The primary flight display for 
the research pilot is a synthetic out-the- 
window view with a Fleads-Up Display 
(HUD) (Figure 7). The HUD displays 
airspeed, altitude, angle of attack, angle 
of sideslip, normal load factor, bank 
angle, pitch angle, heading (both 
magnetic and ground track), a velocity 
vector indicator, vertical speed, and 
engine RPM. The HUD also displays 
information regarding the FCS, including 
arm/engage status of FCS modes, an 
Figure 8. Aircraft Configuration DisDlav. airspeed command bug, autothrottle 

commands, and angle of attack command bugs. In addition to the visual indicators, one of two distinct audio tones is 
played whenever a FCS mode engages or disengages. The HUD also displays visual caution and warning indicators, 
which are accompanied by audio tones. 

The Aircraft Configuration Display (Figure 8) shows the current state of the aircraft (control surface positions, 
gear, flaps, engine data, fuel state) and the current state of the FCS (arm/engage status, profile/FCL selected, 
airspeed command). 
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IV. Summary and Future Plans 

A flight control system architecture for the NASA AirSTAR infrastructure has been designed to address the 
challenges associated with safe and efficient flight testing of research control laws in adverse flight conditions. The 
AirSTAR flight control system is a flexible framework that enables NASA Aviation Safety Program research 
objectives by allowing rapid integration and testing research control laws. Component or sensor failures can be 
emulated in the FCS, in addition to the capability to inject automated control surface perturbations. A baseline 
control law is provided which uses an angle of attack command augmentation system for the pitch axis and simple 
stability augmentation for the roll and yaw axes. A Load Protection System prevents the FCS from exceeding the 
structural limits of the aircraft. 

Future development of the AirSTAR FCS will include envelope expansion of the baseline FCL (Mode 2), 
addition of roll rate and sideslip angle command augmentation controllers to the baseline FCL, and exploration of 
alternative control strategies for the baseline FCL (e.g. pitch rate command). In addition, a model-tracking controller 
will be developed for the Model Tracking & Failures module, allowing in-flight simulation of adverse dynamics. 
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